在strongswan VPN服务器上可以使用MySQL后端进行用户身份validation吗？

SQL插件提供configuration细节，但也存储在数据库中的凭据。 不需要将所有内容都存储在数据库中，数据可以与其他插件提供的数据相结合。 所以可以使用stroke插件从ipsec.conf和来自/etc/ipsec.d/证书提供configuration，但是在数据库中而不是在ipsec.secrets定义用于EAP / XAuth身份validation的用户名和密码。 mysql插件提供的驱动程序是sql插件需要的，用于访问MySQL数据库。

如上所述，您可以自由地忽略提供configuration的表，而是分别在shared_secrets和identities表中定义秘密和用户名，并通过shared_secret_identity表关联它们。 id2sql脚本（未安装，但内置在strongSwan构build目录的scripts文件夹中）提供了一种为identities表生成条目的简单方法。

这里是一些示例SQL数据（有关types的更多信息可以在这里find）：

 INSERT INTO identities ( type, data ) VALUES ( /* type=ID_RFC822_ADDR, [email protected] */ 3, X'6361726f6c407374726f6e677377616e2e6f7267' ); INSERT INTO shared_secrets ( type, data ) VALUES ( /* type=SHARED_EAP/XAUTH, data=Ar3etTnp01qlpOgb */ 2, X'4172336574546e703031716c704f6762' ); /* assumes the entries above are the first ones in their respective * tables, as their id column is auto_increment */ INSERT INTO shared_secret_identity ( shared_secret, identity ) VALUES ( 1, 1 ); 

对于任何绊脚石的人，我使用这个优秀的指南： https ： //www.cl.cam.ac.uk/~mas90/resources/strongswan来做基本的设置，然后像上面那样设置数据库条目。

之后，我使用免费的letsencrypt证书和CN="myvpnserver.mydomain.com"所以我在我的ipsec.conf设置了leftcert=myvpnserver.mydomain.com ipsec.conf 。 然后，我添加了一个入口到types为'2'的mysql表身份和数据'myvpnserver.mydomain.com' （必须使用来自strongswan的id2sql脚本来转换数据条目）。 然后，我从我的身份数据库中获得了该条目的自动分配的ID号，并像上一个条目那样获得了共享秘密ID，以便进入shared_secret_identity，如下所示：

 INSERT INTO shared_secret_identity (shared_secret, identity) VALUES ( id_of_user_logging_in_that_was_set_in_shared_secrets_database, automatically_assigned_id_number_for_myvpnser.mydomain.com_in_identities_database ); 

之后，它的工作。

 # Configure StrongSwan + FreeRADIUS (MariaDB Backend) - CentOS7 # Install Require Packages : [root@strongswan ~]# yum install -y epel-release [root@strongswan ~]# yum update && yum install -y gcc gcc-c++ pam-devel zlib-devel systemd-devel openssl-devel [root@strongswan ~]# yum install -y freeradius freeradius-mysql freeradius-utils mariadb mariadb-server # Download StrongSwan : [root@strongswan ~]# wget http://www.strongswan.org/download/strongswan-5.5.0.tar.gz [root@strongswan ~]# tar zvxf strongswan-5.5.tar.gz [root@strongswan ~]# cd strongswan-5.5.0 # Compile StrongSwan : [root@strongswan ~]# ./configure --prefix=/usr --sysconfdir=/etc/strongswan --localstatedir=/var --enable-unity --enable-xauth-eap --enable-eap-identity --enable-eap-md5 --enable-xauth-pam --enable-eap-tls --enable-eap-radius --enable-eap-mschapv2 --enable-dhcp --enable-systemd --enable-eap-dynamic --enable-openssl --enable-addrblock --enable-certexpire --enable-radattr --enable-swanctl --disable-gmp [root@strongswan ~]# make && make install # Generate Certificates : [root@strongswan ~]# cd /etc/strongswan/ipsec.d/ [root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/strongswanKey.pem [root@strongswan ipsec.d]# ipsec pki --self --ca --lifetime 3650 --in private/strongswanKey.pem --type rsa --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > cacerts/strongswanCert.pem [root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/vpnHostKey.pem [root@strongswan ipsec.d]# chmod 600 private/vpnHostKey.pem [root@strongswan ipsec.d]# ipsec pki --pub --in private/vpnHostKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --san 192.168.1.1 --flag serverAuth --outform pem > certs/vpnHostCert.pem # Generate Client Certificate : [root@strongswan ipsec.d]# ipsec pki --gen --type rsa --size 2048 --outform pem > private/ClientKey.pem [root@strongswan ipsec.d]# chmod 600 private/ClientKey.pem [root@strongswan ipsec.d]# ipsec pki --pub --in private/ClientKey.pem --type rsa | ipsec pki --issue --lifetime 730 --cacert cacerts/strongswanCert.pem --cakey private/strongswanKey.pem --dn "C=Ir, O=IT, CN=StrongSwanVPN" --outform pem > certs/ClientCert.pem # Export CLIENT CERTIFICATE As a PKCS#12 File : [root@strongswan ipsec.d]# openssl pkcs12 -export -inkey private/ClientKey.pem -in certs/ClientCert.pem -name "Client's VPN Certificate" -certfile cacerts/strongswanCert.pem -caname "strongSwan Root CA" -out Client.p12 # Configure StrongSwan : [root@strongswan ~]# vim /etc/strongswan/ipsec.conf ------------------------ config setup uniqueids=no conn standard_ikev2 keyexchange=ikev2 ike=aes256-sha256-modp1024,3des-sha1-modp1024,aes256-sha1-modp1024! esp=aes256-sha256,3des-sha1,aes256-sha1! fragmentation=no rekey=no left=192.168.1.1 leftsendcert=always leftfirewall=yes leftsubnet=0.0.0.0/0 leftcert=vpnHostCert.pem right=%any rightauth=eap-radius rightsourceip=10.0.0.0/24 eap_identity=%any dpdaction=clear auto=add ------------------------ [root@strongswan ~]# vim /etc/strongswan/ipsec.secrets : RSA vpnHostKey.pem [root@strongswan ~]# vim /etc/strongswan/strongswan.conf ------------------------ charon { load_modular = yes compress = yes plugins { include strongswan.d/charon/*.conf eap-radius { servers { server-a { accounting = yes secret = 123456 address = 192.168.1.1 auth_port = 1812 acct_port = 1813 } } } } include strongswan.d/*.conf } ------------------------ [root@strongswan ~]# vim /etc/sysctl.conf net.ipv4.ip_forward = 1 net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.all.send_redirects = 0 # start strongswan service : [root@strongswan ~]# systemctl start strongswan && systemctl enable strongswan # Configure FreeRADIUS : [root@strongswan ~]# vim /etc/raddb/mods-available/sql ------------------------ database = "mysql" driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = "radius-password" radius_db = "radius" read_clients = yes ------------------------ # Enable sql Module : [root@strongswan ~]# ln -s /etc/raddb/mods-available/sql /etc/raddb/mods-enabled/sql # Comment "files" and Uncomment "sql" : [root@strongswan ~]# vim /etc/raddb/sites-available/default # Comment -> "files" and Uncomment -> "sql" : [root@strongswan ~]# vim /etc/raddb/sites-available/inner-tunnel [root@strongswan ~]# vim /etc/raddb/client.conf ------------------------ client 0.0.0.0 { secret = 123456 nas_type = other shortname = 0.0.0.0 require_message_authenticator = no } ------------------------ [root@strongswan ~]# cat /etc/strongswan/ipsec.d/cacerts/strongswanCert.pem > /etc/raddb/certs/ca.pem [root@strongswan ~]# cat /etc/strongswan/ipsec.d/certs/vpnHostCert.pem > /etc/raddb/certs/server.pem [root@strongswan ~]# cat /etc/strongswan/ipsec.d/private/vpnHostKey.pem > /etc/raddb/certs/server.key [root@strongswan ~]# cat /etc/raddb/certs/server.key >> /etc/raddb/certs/server.pem # start radiusd service : [root@strongswan ~]# systemctl start radiusd && systemctl enable radiusd ## Configure MariaDB : [root@strongswan ~]# systemctl start mariadb && systemctl enable mariadb [root@strongswan ~]# mysql_secure_installation [root@strongswan ~]# mysql -u root -p Enter Password: ****** MariaDB> create database radius; MariaDB> grant all privileges on radius.* to radius@localhost identified by "radius-password"; MariaDB> flush privileges; MariaDB> use radius; MariaDB> source /etc/raddb/mods-config/sql/main/mysql/schema.sql; # add username|password : MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('ehsan','Cleartext-Password',':=','eh@12345'); MariaDB> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES ('alireza','Cleartext-Password',':=','abc123');